Update

2026-08-12 19:57:34 +00:00 · 2020-09-20 19:45:33 +02:00
parent 12f79247dd
commit 041639f430
2 changed files with 66 additions and 0 deletions
@@ -0,0 +1,65 @@
+function Get-GPOZaurrPermissionRoot {
+    [cmdletBinding()]
+    param(
+        [alias('ForestName')][string] $Forest,
+        [string[]] $ExcludeDomains,
+        [alias('Domain', 'Domains')][string[]] $IncludeDomains,
+        [System.Collections.IDictionary] $ExtendedForestInformation
+    )
+    Begin {
+        #$Owners = [System.Collections.Generic.List[object]]::new()
+        #$Modify = [System.Collections.Generic.List[object]]::new()
+        $ForestInformation = Get-WinADForestDetails -Forest $Forest -IncludeDomains $IncludeDomains -ExcludeDomains $ExcludeDomains -ExtendedForestInformation $ExtendedForestInformation -Extended
+    }
+    Process {
+        foreach ($Domain in $ForestInformation.Domains) {
+            $DomainDistinguishedName = $ForestInformation['DomainsExtended'][$Domain].DistinguishedName
+            $getADACLSplat = @{
+                ADObject                       = "CN=Policies,CN=System,$DomainDistinguishedName"
+                IncludeActiveDirectoryRights   = 'GenericAll', 'CreateChild', 'WriteOwner', 'WriteDACL'
+                IncludeObjectTypeName          = 'All', 'Group-Policy-Container'
+                IncludeInheritedObjectTypeName = 'All', 'Group-Policy-Container'
+                ADRightsAsArray                = $true
+                ResolveTypes                   = $true
+            }
+            $GPOPermissionsGlobal = Get-ADACL @getADACLSplat
+            #$GPOPermissionsGlobal | Format-Table
+            foreach ($Permission in $GPOPermissionsGlobal) {
+                if ($Permission.ActiveDirectoryRights | ForEach-Object {
+                        $_ -in 'WriteDACL', 'WriteOwner', 'GenericAll'
+                    }) {
+                    [PSCustomObject] @{
+                        Permission     = 'GpoCustomOwner'
+                        Type           = $Permission.PrincipalObjectType
+                        Name           = $Permission.Principal
+                        DomainName     = $Permission.PrincipalObjectDomain
+                        PermissionType = $Permission.AccessControlType
+                        GPOCount       = 'N/A'
+                        GPONames       = 'All'
+                    }
+                    #$Owners.Add($Permission)
+                }
+                if ($Permission.ActiveDirectoryRights | ForEach-Object {
+                        $_ -in 'CreateChild', 'GenericAll'
+                    }) {
+
+                    [PSCustomObject] @{
+                        Permission     = 'GpoCustomCreate'
+                        Type           = $Permission.PrincipalObjectType
+                        Name           = $Permission.Principal
+                        DomainName     = $Permission.PrincipalObjectDomain
+                        PermissionType = $Permission.AccessControlType
+                        GPOCount       = 'N/A'
+                        GPONames       = 'All'
+                    }
+
+                    #$Modify.Add($Permission)
+                }
+            }
+            #$Owners | Format-Table
+
+            #$Modify | Format-Table
+        }
+    }
+    End {}
+}
@@ -51,6 +51,7 @@ That's it. Whenever there's a new version, you run the command, and you can enjo

 - 0.0.62 - Unreleased
  - Improvements to `Get-GPOZaurrPermissionConsistency` for GPOs without SYSVOL to be reported properly
+  - Added `Get-GPOZaurrPermissionRoot`
 - 0.0.61 - 31.08.2020
  - Improvement to `Get-GPOZaurrPermissionSummary`
  - Fixes to `ConvertFrom-CSExtension`